CVE-2026-24667

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24667", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-23T20:40:23.387Z", "datePublished": "2026-02-03T16:59:32.119Z", "dateUpdated": "2026-02-04T16:51:49.025Z"}, "containers": {"cna": {"title": "Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access", "problemTypes": [{"descriptions": [{"cweId": "CWE-613", "lang": "en", "description": "CWE-613: Insufficient Session Expiration", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224"}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"version": "< 4.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:59:32.119Z"}, "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2."}], "source": {"advisory": "GHSA-5h73-53mh-m224", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T15:46:28.905681Z", "id": "CVE-2026-24667", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T16:51:49.025Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24667", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-04T15:46:28.905681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T15:46:29.606Z"}}], "cna": {"title": "Open eClass's Active Sessions Not Invalidated After Password Change Allow Persistent Account Access", "source": {"advisory": "GHSA-5h73-53mh-m224", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "gunet", "product": "openeclass", "versions": [{"status": "affected", "version": "< 4.2"}]}], "references": [{"url": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224", "name": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-613", "description": "CWE-613: Insufficient Session Expiration"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-03T16:59:32.119Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24667", "state": "PUBLISHED", "dateUpdated": "2026-02-04T16:51:49.025Z", "dateReserved": "2026-01-23T20:40:23.387Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-03T16:59:32.119Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "openeclass", "vendor": "gunet", "versions": [{"status": "affected", "version": "< 4.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gunet:open_eclass_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "62F1C084-2C90-4AB3-A13E-28323DC385C0", "versionEndExcluding": "4.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, failure to invalidate active user sessions after a password change allows existing session tokens to remain valid, potentially enabling unauthorized continued access to user accounts. This issue has been patched in version 4.2."}, {"lang": "es", "value": "La plataforma Open eClass (anteriormente conocida como GUnet eClass) es un sistema completo de gesti\u00f3n de cursos. Antes de la versi\u00f3n 4.2, la falta de invalidaci\u00f3n de las sesiones de usuario activas despu\u00e9s de un cambio de contrase\u00f1a permite que los tokens de sesi\u00f3n existentes sigan siendo v\u00e1lidos, lo que podr\u00eda permitir el acceso continuado no autorizado a las cuentas de usuario. Este problema ha sido parcheado en la versi\u00f3n 4.2."}], "id": "CVE-2026-24667", "lastModified": "2026-06-17T10:23:23.243", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24667", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T15:46:28.905681Z", "version": "2.0.3"}}]}, "published": "2026-02-03T18:16:19.917", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gunet/openeclass/security/advisories/GHSA-5h73-53mh-m224"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-613"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T00:16:57.544253+00:00", "value": {"mitigation_remediation": ["Apply the official update to Open eClass version 4.2 or later to ensure that session tokens are invalidated immediately after a password change.", "If upgrading is not possible, enforce a manual session flush (remove all active session records) immediately following any password change through custom administrative scripts or database operations.", "Implement monitoring to detect any sessions that persist beyond a password change event, and audit user activity logs for suspicious continued access."], "summary": {"action": "Update", "impact": "Account hijacking via persistent session tokens"}, "threat_synthesis": {"affected_systems": "The issue affects the Open eClass community edition released as gunet:openeclass. Versions built from source prior to 4.2 are vulnerable; the fix was included in release 4.2 and later.", "description_and_impact": "Active user sessions in the Open eClass platform are not cleared when a password change occurs, which means a session token that was issued before the password was changed can still be used, allowing an attacker to maintain access to an account without needing the new credentials. This flaw enables the persistence of a compromised session and therefore can lead to unauthorized disclosure, tampering, or destruction of a user\u2019s data, classified as a session hijacking weakness (CWE-613).", "risk_and_exploitability": "The base severity of the vulnerability is a moderate CVSS score of 5.0, and the EPSS score indicates an exploitation probability of less than 1%. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is an authenticated or partially authenticated operation where the attacker already possesses a valid session cookie or token; the attacker could also acquire a session token through other vulnerabilities such as XSS, but this is not explicitly disclosed. Exploitation requires that the attacker leverage a session that remained active after a password change and does not involve a separate vulnerability to obtain that token. The risk is that an attacker who gains ownership of a session token can continue to use the account with no indication of the password change; ongoing monitoring of session activity and audit logs is advised."}}}}, "created": "2026-02-04T12:09:48.186832+00:00", "updated": "2026-04-18T00:30:25.700740+00:00", "vendors": ["openeclass", "openeclass$PRODUCT$openeclass"]}